CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- datalinkdc dinkyDataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery6.9 Medium
- infiniflow ragflowInfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery5.3 Medium
- oqtane oqtane.frameworkOqtane Framework before 10.3.0 SSRF via File Upload From URL5.3 Medium
- cosin2077 easyvoiceeasyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API6.9 Medium
- coupa total spend management platformMultiple vulnerabilities in Coupa’s Total Spend Management Platform8.4 High
- gtmserver stape conversion trackingStape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path7.1 High
- unknown powerpack addons for elementor: widgets, form styler and templatesPowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import4.1 Medium
- mlflowMLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability8.2 High
- No product listedArcReel Provider Test-Connection Endpoint test server-side request forgery5.3 Medium
- devolutions serverServer-side request forgery in the Active Directory credential validation in Devolutions Server...8.1 High
- devolutions serverServer-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0...8.1 High
- tp-link systems inc. tapo cloud serviceServer-Side Request Forgery in Tapo Cloud MQTT Proxy8.3 High
- djangoproject djangoServer-side request forgery via SpatialReference string input6.9 Medium
- djangoproject djangoServer-side request forgery via crs member of GeoJSON geometries6.9 Medium
- humansignal label-studio, label-studio-sdk +1 moreLabel Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads6.3 Medium
- azuracastAzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors6.9 Medium
- surrealdbSurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass5.1 Medium
- surrealdbSurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass5.3 Medium
- surrealdbSurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses4.8 Medium
- typo3 extension "mail"Server-Side Request Forgery in extension "Mail" (mail)5.3 Medium
- eclipse foundation mnestixUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures9.2 Critical
- ghozylab gallery for social photoGallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter5.8 Medium
- andyfactory newspaper4kAndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery6.9 Medium
- crewaiCVE-2026-1206309.1 Critical
- suse rancherRancher meta proxy allowlist bypass leading to server-side request forgery7.6 High
- No product listedGoogle::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials9.8 Critical
- nationalsecurityagency emissaryNationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF4.8 Medium
- christianhelle refitterRefitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion7.1 High
- stirling-tools stirling-pdfStirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read6.8 Medium
- stirling-tools stirling-pdfStirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass5.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Materialized view refresh redirects its connection through a crafted database name7.1 High
- madeofpendletonwool pinepodsPinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)9.1 Critical
- osac-project osac-operatorOSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy8.6 High
- duck-organization questbotQuest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services2.3 Low
- pipeshub-aiPipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents5.3 Medium
- goniszewski grimoireGrimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata6.9 Medium
- basecamp once-campfireCampfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard3.1 Low
- arcadedata arcadedbArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List7.1 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF...2.7 Low
- jellyfinJellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images7.1 High
- forgejoForgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery6.9 Medium
- phpmyadminphpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled6.3 Medium
- hashicorp boundary, boundary enterprise +1 moreBoundary vulnerable to server-side request forgery in Vault credential store8.7 High
- randombit botanBotan: Online OCSP redirects enable blind requests to internal HTTP services6.1 Medium
- unclecode crawl4aiCrawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check6.9 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities5.0 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities4.3 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities4.3 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities5.4 Medium
- bmc it service management suiteServer-Side Request Forgery in BMC ITSM SmartIT5.3 Medium
- Show moreLoading…